Insider Threat Reporting and Security Guidance Act of 2026
- Sponsor
- Sen. Banks, Jim [R-IN]
- Committees
- Armed Services Committee (primary)
- Last action
- Sep 29, 2026
Bottom line
This bill aims to enhance national security by mandating transparency and promoting best practices among large AI contractors working with the Department of Defense to mitigate risks from espionage, sabotage, and misuse of advanced AI systems.
What it actually does
This bill mandates that the Secretary of Defense establish comprehensive reporting requirements and voluntary security guidance for "covered artificial intelligence contractors"—large firms with significant DoD AI contracts and R&D expenditures. These requirements focus on contractor security practices, insider threat mitigation, and the prompt reporting of incidents affecting the security and integrity of AI models used in defense applications.
Proponents argue
Proponents argue this bill is crucial for safeguarding national security in an era of rapidly advancing AI, ensuring that critical defense systems and data are protected from insider threats and sophisticated nation-state adversaries. They emphasize the need for robust security measures and transparency from contractors developing and deploying powerful AI models for the DoD, highlighting the unique risks associated with AI model integrity and access.
Opponents contend
Potential opponents might raise concerns about the administrative burden and compliance costs imposed on contractors, particularly the extensive reporting requirements which could stifle innovation or create a disincentive for AI companies to work with the DoD. They might also argue that some requirements could lead to the disclosure of proprietary information or trade secrets, despite provisions for protection, or that the definitions for "covered contractors" are too broad or too narrow.
The bill is relatively short and clearly structured, allowing an informed reader to understand its core provisions within a reasonable timeframe.
Section 2(a)
Defining "Covered Artificial Intelligence Contractor"
This provision defines which contractors are subject to the bill's requirements. It applies to contractors with Department of Defense (DoD) AI contracts worth at least $100 million, AND who have incurred $1 billion in AI research and development expenditures over the past three years, or use an AI model from a person meeting those expenditure criteria. This ensures the focus is on large, significant AI players.
Supporters argue
Supporters would argue this definition appropriately targets the largest and most influential AI developers whose systems pose the greatest potential national security risks, ensuring oversight without overburdening smaller innovators.
Critics contend
Critics might argue the financial thresholds are arbitrary or could inadvertently exclude critical smaller firms or include firms whose AI contributions are less sensitive, leading to either gaps in coverage or unnecessary burdens.
Tradeoffs
Balances the need for comprehensive oversight of significant AI systems with avoiding undue regulatory burden on the broader AI industry.
Section 2(b)
Establishment of Reporting Requirements
This section requires the Secretary of Defense to issue regulations within 180 days of enactment to establish mandatory reporting requirements for covered AI contractors. These reports are intended to support the protection of DoD systems, missions, personnel, operations, and supply chains from counterintelligence, security, and other national security risks arising from contractor security practices.
Section 2(b)(2)
Specific Content of Required Reports
This provision mandates that the regulations require contractors to report on a wide range of security matters. These include policies for personnel vetting, insider threat mitigation, access controls (including for third parties accessing AI models), supply chain security, and prevention of unauthorized AI model modification. Contractors must also report any known or suspected material incidents affecting AI model security, defense-relevant capabilities of powerful AI models, concerning model behavior, attempts to gain unauthorized access to AI intellectual property, and other acute national security risks.
Section 2(b)(3)
72-Hour Notification for Acute National Security Incidents
This provision requires covered contractors to notify the Secretary of Defense within 72 hours of becoming aware of any information, incident, or development that presents an acute national security risk. Notifications must include detailed descriptions of the incident, affected models, means of compromise, potential impact on DoD missions, and actions taken. The Secretary must then promptly transmit this notification to relevant DoD and federal agencies, and notify congressional defense committees within 7 days.
Section 2(c)
Voluntary Guidance on Insider Threat Risk Reduction
This section directs the Secretary of Defense to issue voluntary guidance within 180 days for covered AI contractors to reduce insider threat, espionage, and personnel-related security risks to sensitive AI assets, focusing on threats from highly capable nation-state adversaries. The guidance will include a tiered framework for security measures based on access and sensitivity, and assess practices for personnel vetting, access controls, monitoring, and protection against sabotage.
This subparagraph clarifies that the reporting requirements apply even if a covered contractor uses an AI model developed or controlled by another person. It explicitly states that the Secretary may require the covered contractor to obtain necessary information from that third party.
Section 2(b)(2)(B)
Why it matters:Likely standard legislative practice to ensure comprehensive coverage and prevent loopholes where contractors might outsource AI development to avoid reporting.
Case for: Supporters would argue this provision is crucial to prevent evasion of reporting requirements, ensuring that all AI models used in DoD contracts, regardless of their immediate developer, are subject to the same security scrutiny. This closes a potential loophole.
Case against: Critics might argue this places an undue burden on covered contractors, forcing them to compel information from third-party developers who may be reluctant to share proprietary data, potentially complicating supply chains and increasing costs.
Estimated impact: Significantly broadens the scope of data collection and compliance responsibility for covered contractors, potentially impacting their relationships with AI model providers.
This provision requires the Secretary of Defense to include procedures in the regulations for protecting classified information, proprietary information, trade secrets, security-sensitive information, and vulnerability information during the submission of notifications.
Section 2(b)(3)(D)
Why it matters:Standard legislative practice to ensure that necessary protections for sensitive information are explicitly mandated, addressing industry concerns without making it a primary headline.
Case for: Proponents would highlight this as a vital safeguard, ensuring that contractors can comply with reporting requirements without jeopardizing their intellectual property or inadvertently exposing national security vulnerabilities through public disclosure.
Case against: While generally supported, some critics might argue that the effectiveness of these protections will depend entirely on the specific regulations issued by the Secretary, and that the bill itself doesn't provide enough detail on how these protections will be implemented or enforced.
Estimated impact: Crucial for fostering trust and compliance from contractors, potentially reducing resistance to sharing sensitive security information.